Register Guidelines E-Books Search Today's Posts Mark Forums Read

Go Back   MobileRead Forums > E-Book Readers > More E-Book Readers > iRex > iRex Developer's Corner

Notices

Reply
 
Thread Tools Search this Thread
Old 07-22-2006, 06:31 AM   #1
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
Sniffing the iDS connection

Has anyone yet tried to sniff the traffic when the iLiad connects to iDS? I know it's SSL-protected, but with a MitM attack using tools like Ettercap or dsniff you should be able to deal with it.

Sniffing the traffic, we could then find out - for instance - how the iRex does remote flash upgrades.
TadW is offline   Reply With Quote
Old 07-22-2006, 06:51 AM   #2
ali
Addict
ali doesn't litterali doesn't litter
 
ali's Avatar
 
Posts: 302
Karma: 116
Join Date: May 2006
Device: Iliad, dude!
Quote:
Originally Posted by TadW
Sniffing the traffic, we could then find out - for instance - how the iRex does remote flash upgrades.
Essentially we know that - it stores packages in some directory, and they're executed from start.sh / do_updates.sh on reboot. So this doesn't help if the OS is screwed, as it doesn't really reflash. (I assume you were thinking about that)
ali is offline   Reply With Quote
Old 07-22-2006, 06:58 AM   #3
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
True it wouldn't help to fix a dead iLiad (for that we'd probably need to find out how to boot the iRex connected via usb and lan to some BootP/TFTP server).

But if you capture the ids connection, you might find out other interesting things. For instance, what data is exactly being transferred to the server. Or, how does the flash file(s) look like? By capturing the flash file(s), one could find out the structure of the flash - and then we could perhaps disect it and write custom flash files.
TadW is offline   Reply With Quote
Old 08-08-2006, 09:54 AM   #4
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
I also posted this elsewhere in this forum, but in case someone is looking for specific information how to sniff the traffic from your iLiad, here the info again:

Let's assume:
  • your router has the IP 192.168.0.1 and acts as the gateway
  • your iLiad has the IP 192.168.0.10
  • your laptop has the IP 192.168.0.11

Then use the following Ettercap commandline to log all traffic between your router and the iLiad:

Code:
ettercap -Tq -L /tmp/logfile.log -M arp:remote /192.168.0.1/ /192.168.0.10/
If iDS uses a secured connection (over SSL), you'll have to do some extra work to import the certificate into Ettercap.

Last edited by TadW; 08-15-2006 at 12:59 PM. Reason: added quite mode switch -q
TadW is offline   Reply With Quote
Old 08-08-2006, 12:04 PM   #5
arivero
Guru
arivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it isarivero knows what time it is
 
arivero's Avatar
 
Posts: 607
Karma: 2157
Join Date: Oct 2005
Device: NCR3125, Nokia 770,...
Quote:
Originally Posted by ali
Essentially we know that - it stores packages in some directory, and they're executed from start.sh / do_updates.sh on reboot. So this doesn't help if the OS is screwed, as it doesn't really reflash. (I assume you were thinking about that)
This is partly right, partly wrong. The 2.4 miniupdate stored a package with a new waveform and then a script in rc.d/ so it was executed.. at shutdown!

Then the 2.5 update did the designed update method, running from the script in /old-root (the initial run). This script runs instead of "init" when the machine starts-up, and then it chroots and switches into init. The script checks for the presence of files in the update directories and for the raising of a pair of flags somewhere in the hardware.
arivero is offline   Reply With Quote
Old 08-09-2006, 05:04 AM   #6
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
SSL MITM Attack of iLiad reader

Requirement: OpenSSL libraries to support SSL and TLS

To sniff a HTTPS connection with Ettercap, we must set up two separate SSL tunnels. Essentially we first ARP poison the iLiad and the gateway (as described earlier), then intercept the iLiad's SSL request, and present it with our own certificate. When the iLiad accepts the certificate, ettercap establishes an SSL tunnel from the device to itself, masquerading as the iDS server. It then establishes a second SSL tunnel to the real web server, with itself as the SSL client.
  1. We have to create our SSL certificate (if your installation of Ettercap didn't do it already for you):

    Code:
    openssl genrsa -out etter.ssl.crt 1024 
    openssl req -new -key etter.ssl.crt -out tmp.csr
    openssl x509 -req -days 1825 -in tmp.csr -signkey etter.ssl.crt -out tmp.new
    cat tmp.new >> etter.ssl.crt
    rm -f tmp.new tmp.csr 
    cp etter.ssl.crt /usr/local/share/ettercap (path can differ depending on your installation of ettercap)
  2. Edit /etc/etter.conf, and do the following important changes:
    • ec_uid=0 (otherwise Ettercap cannot access your iptables rules needed to establish the forwarding)
    • further down the config file, uncomment the firewall rules that apply to your sniffing host. For instance, if you run Linux with iptables (most likely), uncomment as in the following example:
      Code:
      #---------------
      #     Linux
      #---------------         
      
      # if you use ipchains:
         #redir_command_on = "ipchains -A input -i %iface -p tcp -s 0/0 -d 0/0 %port -j REDIRECT %rport"
         #redir_command_off = "ipchains -D input -i %iface -p tcp -s 0/0 -d 0/0 %port -j REDIRECT %rport"
      
      # if you use iptables:
         redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
         redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  3. iptables –N nat (to make the iptables table nat)
  4. start sniffing as explained before:
    • ettercap -Tq -L /tmp/logfile.log -M arp:remote /192.168.0.1/ /192.168.0.10/ (here: router = 192.168.0.1, iLiad = 192.168.0.10)
TadW is offline   Reply With Quote
Old 08-09-2006, 05:34 AM   #7
deadite66
Groupie
deadite66 began at the beginning.
 
deadite66's Avatar
 
Posts: 197
Karma: 16
Join Date: Apr 2006
Device: irex iliad, uk Kindle gen3
would the iliad see the cert as coming from irex?
the mitm attacts i've seen depended on the victim accepting the certificate without properly checking it.
i tried an ssl proxy program but the iliad wouldn't accept the certificate.

Last edited by deadite66; 08-09-2006 at 06:24 AM.
deadite66 is offline   Reply With Quote
Old 08-09-2006, 09:51 AM   #8
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
Yeah it would see it as coming from the iRex. Why don't you test it by sniffing another PC and then running a HTTPS site. You will get a message that the certificate is not valid (because our fake is not signed e.g. by Thawte), but if you look at the details of the certificate, you see its the one that's originally coming from the server. If you want to make the attack perfectly undistinguishable, you'd have to use a signed certificate.

I don't exactly know how you tried an ssl proxy program on the iLiad.
TadW is offline   Reply With Quote
Old 08-09-2006, 05:31 PM   #9
deadite66
Groupie
deadite66 began at the beginning.
 
deadite66's Avatar
 
Posts: 197
Karma: 16
Join Date: Apr 2006
Device: irex iliad, uk Kindle gen3
did you get my pm TadW?

ettercap only picked up UDP traffic.
deadite66 is offline   Reply With Quote
Old 08-10-2006, 04:04 AM   #10
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
I PMed you back. You must make sure to give Ettercap root privileges, or it won't be able to tune your firewall for the necessary forwarding rules. See point 2 above.
TadW is offline   Reply With Quote
Old 08-10-2006, 04:17 AM   #11
deadite66
Groupie
deadite66 began at the beginning.
 
deadite66's Avatar
 
Posts: 197
Karma: 16
Join Date: Apr 2006
Device: irex iliad, uk Kindle gen3
arggg, i made somechanges but the forums wont let me post them.

"server made a boo boo" error :/


hmm, ok will have to do it this way.
http://ghostpilot.dyndns.org/etterlog.txt

Last edited by deadite66; 08-10-2006 at 04:21 AM.
deadite66 is offline   Reply With Quote
Old 08-10-2006, 08:02 AM   #12
Alexander Turcic
Fully Converged
Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.Alexander Turcic ought to be getting tired of karma fortunes by now.
 
Alexander Turcic's Avatar
 
Posts: 17,094
Karma: 10000048
Join Date: Oct 2002
Location: Switzerland
Device: Sony PRS-650 / Nexus 7 / Kindle PW
Quote:
Originally Posted by deadite66
arggg, i made somechanges but the forums wont let me post them.

"server made a boo boo" error :/


hmm, ok will have to do it this way.
http://ghostpilot.dyndns.org/etterlog.txt
Sorry about that, the content of your etterlog file hit our intrusion detection. If you have this problem again, try zipping it first. Thanks!
Alexander Turcic is offline   Reply With Quote
Old 08-10-2006, 08:11 AM   #13
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
deadite66, any news?
TadW is offline   Reply With Quote
Old 08-10-2006, 05:37 PM   #14
deadite66
Groupie
deadite66 began at the beginning.
 
deadite66's Avatar
 
Posts: 197
Karma: 16
Join Date: Apr 2006
Device: irex iliad, uk Kindle gen3
only this http://ghostpilot.dyndns.org/etterlog.txt so far, well i seem to have sniffed the time sync from the ids.
deadite66 is offline   Reply With Quote
Old 08-11-2006, 03:32 AM   #15
TadW
Uebermensch
TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.TadW ought to be getting tired of karma fortunes by now.
 
TadW's Avatar
 
Posts: 2,580
Karma: 1094606
Join Date: Jul 2003
Location: Italy
Device: Kindle
Looks very good to me. Hope the instruction was a bit useful, too

Now it's getting more interesting to see what's going on when you e.g. update the device. You could easily catch the entire content of the update and save it to an external file.
TadW is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
ids down ? reaver121 iRex 0 01-16-2010 09:53 AM
Wireless internet connection frustrating IDS connection Socrates iRex 8 10-21-2009 12:46 PM
how to connect to ids? foxql iRex 10 04-01-2009 10:38 AM
Cannot Find an Answer IDS Connection barney111 iRex 3 11-04-2008 07:13 AM
iLiad I want to connect to IDS. Please help me. wklee iRex Developer's Corner 3 07-17-2007 11:52 PM


All times are GMT -4. The time now is 04:47 AM.


MobileRead.com is a privately owned, operated and funded community.